admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): drop built-in well-known MCP client list

Browse Source 
The client registry derived display names from a hardcoded map of
"well-known" MCP clients (claude-desktop, claude-ai, continue-dev,
zed-editor, vscode-mcp). This baked a recognized-client list into the
server even though admission already requires explicit opt-in via
ALLOWED_MCP_CLIENTS (fail-closed when unset).

Mirror the management-API surface (ALLOWED_MGMT_CLIENT), which has no
built-in client list: remove the map and derive the display name
generically from the client_id. Default remains none; clients must be
added explicitly and DCR stays off unless ENABLE_DCR=true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-06-16 20:50:17 +02:00
co-authored by Claude Opus 4.8
parent 5a0deac502
commit 11522f88b0
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/test_client_registry.py
+4 -1
View File
@@ -157,8 +157,11 @@ def test_validate_redirect_uri_localhost_wildcard(monkeypatch):
def test_client_name_resolution(monkeypatch):
registry = _get_registry(monkeypatch, "claude-desktop, custom-tool")
# Names are derived generically from the client_id — there is no built-in
# "well-known" client map, so previously special-cased ids now title-case.
registry = _get_registry(monkeypatch, "claude-desktop, claude-ai, custom-tool")
assert registry.get_client("claude-desktop").name == "Claude Desktop"
assert registry.get_client("claude-ai").name == "Claude Ai"
assert registry.get_client("custom-tool").name == "Custom Tool"